SONAR-3755 to list transitions available on an issue, user role on the issue project...

diff --git a/sonar-server/src/main/java/org/sonar/server/issue/InternalRubyIssueService.java b/sonar-server/src/main/java/org/sonar/server/issue/InternalRubyIssueService.java
index 87533a774abb14fee5153ad40aed776da3571d16..321506a052878a2a0f8df1e249f7b164277f2e80 100644 (file)
--- a/sonar-server/src/main/java/org/sonar/server/issue/InternalRubyIssueService.java
+++ b/sonar-server/src/main/java/org/sonar/server/issue/InternalRubyIssueService.java
@@ -81,11 +81,11 @@ public class InternalRubyIssueService implements ServerComponent {
   }
 
   public List<Transition> listTransitions(String issueKey) {
-    return issueService.listTransitions(issueKey);
+    return issueService.listTransitions(issueKey, UserSession.get());
   }
 
   public List<Transition> listTransitions(Issue issue) {
-    return issueService.listTransitions(issue);
+    return issueService.listTransitions(issue, UserSession.get());
   }
 
   public List<String> listStatus() {

diff --git a/sonar-server/src/main/java/org/sonar/server/issue/IssueService.java b/sonar-server/src/main/java/org/sonar/server/issue/IssueService.java
index 8d694dd2b2a224e174d0ab9f307208236a91b9d7..f6a9e846b0a740e7ca1e0f14cfd8bcb314873c51 100644 (file)
--- a/sonar-server/src/main/java/org/sonar/server/issue/IssueService.java
+++ b/sonar-server/src/main/java/org/sonar/server/issue/IssueService.java
@@ -92,17 +92,18 @@ public class IssueService implements ServerComponent {
    * <p/>
    * Never return null, but return an empty list if the issue does not exist.
    */
-  public List<Transition> listTransitions(String issueKey) {
-    return listTransitions(loadIssue(issueKey).first());
+  public List<Transition> listTransitions(String issueKey, UserSession userSession) {
+    return listTransitions(loadIssue(issueKey).first(), userSession);
   }
 
   /**
    * Never return null, but an empty list if the issue does not exist.
    */
-  public List<Transition> listTransitions(@Nullable Issue issue) {
+  public List<Transition> listTransitions(@Nullable Issue issue, UserSession userSession) {
     if (issue == null) {
       return Collections.emptyList();
     }
+    checkAuthorization(userSession, issue, UserRole.USER);
     return workflow.outTransitions(issue);
   }
 

diff --git a/sonar-server/src/test/java/org/sonar/server/issue/ActionPlanServiceTest.java b/sonar-server/src/test/java/org/sonar/server/issue/ActionPlanServiceTest.java
index fdf586dbd6bdfdfda74c9ce8daacfc7837f4d95a..05028775774f62cb2e485f416323693445c3e22c 100644 (file)
--- a/sonar-server/src/test/java/org/sonar/server/issue/ActionPlanServiceTest.java
+++ b/sonar-server/src/test/java/org/sonar/server/issue/ActionPlanServiceTest.java
@@ -69,6 +69,7 @@ public class ActionPlanServiceTest {
 
     actionPlanService.create(actionPlan, userSession);
     verify(actionPlanDao).save(any(ActionPlanDto.class));
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.ADMIN));
   }
 
   @Test
@@ -112,6 +113,7 @@ public class ActionPlanServiceTest {
 
     assertThat(result).isNotNull();
     assertThat(result.status()).isEqualTo("CLOSED");
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.ADMIN));
   }
 
   @Test
@@ -121,6 +123,7 @@ public class ActionPlanServiceTest {
 
     actionPlanService.update(actionPlan, userSession);
     verify(actionPlanDao).update(any(ActionPlanDto.class));
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.ADMIN));
   }
 
   @Test
@@ -129,6 +132,7 @@ public class ActionPlanServiceTest {
     when(resourceDao.getResource(any(ResourceQuery.class))).thenReturn(new ResourceDto().setKey("org.sonar.Sample").setId(1l));
     actionPlanService.delete("ABCD", userSession);
     verify(actionPlanDao).delete("ABCD");
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.ADMIN));
   }
 
   @Test
@@ -139,6 +143,7 @@ public class ActionPlanServiceTest {
     ActionPlan result = actionPlanService.findByKey("ABCD", userSession);
     assertThat(result).isNotNull();
     assertThat(result.key()).isEqualTo("ABCD");
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.USER));
   }
 
   @Test
@@ -162,6 +167,7 @@ public class ActionPlanServiceTest {
     Collection<ActionPlan> results = actionPlanService.findOpenByProjectKey("org.sonar.Sample", userSession);
     assertThat(results).hasSize(1);
     assertThat(results.iterator().next().key()).isEqualTo("ABCD");
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.USER));
   }
 
   @Test
@@ -193,6 +199,7 @@ public class ActionPlanServiceTest {
 
     Collection<ActionPlanStats> results = actionPlanService.findActionPlanStats("org.sonar.Sample", userSession);
     assertThat(results).hasSize(1);
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.USER));
   }
 
   @Test(expected = IllegalArgumentException.class)

diff --git a/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceTest.java b/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceTest.java
index 0f640f2f286b845ffe016efe3c8dcdc3429301bb..584c217ad069940cceef9edaee03b399870dac11 100644 (file)
--- a/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceTest.java
+++ b/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceTest.java
@@ -118,20 +118,23 @@ public class IssueServiceTest {
 
   @Test
   public void should_list_transitions() {
+    grantAccess();
     List<Transition> transitions = newArrayList(transition);
     when(workflow.outTransitions(issue)).thenReturn(transitions);
 
-    List<Transition> result = issueService.listTransitions("ABCD");
+    List<Transition> result = issueService.listTransitions("ABCD", userSession);
     assertThat(result).hasSize(1);
     assertThat(result.get(0)).isEqualTo(transition);
+    verify(authorizationDao).isAuthorizedComponentId(anyLong(), anyInt(), eq(UserRole.USER));
   }
 
   @Test
   public void should_return_no_transition() {
+    grantAccess();
     when(issueQueryResult.first()).thenReturn(null);
     when(issueQueryResult.issues()).thenReturn(newArrayList((Issue) new DefaultIssue()));
 
-    assertThat(issueService.listTransitions("ABCD")).isEmpty();
+    assertThat(issueService.listTransitions("ABCD", userSession)).isEmpty();
     verifyZeroInteractions(workflow);
   }